refactor get-oncall and use terraform to deploy

.github/dependabot.yml

@@ -16,12 +16,23 @@
 version: 2
 updates:
   - package-ecosystem: gomod
-    directory: "./get-oncall"
+    directory: "/"
     schedule:
       interval: "daily"
     open-pull-requests-limit: 10
+    groups:
+      gomod:
+        update-types:
+          - "minor"
+          - "patch"
+
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "daily"
     open-pull-requests-limit: 10
+    groups:
+      actions:
+        update-types:
+          - "minor"
+          - "patch"

.github/testdata/backend_override.tf

@@ -0,0 +1,8 @@
+terraform {
+  backend "local" {
+    path = "./.local-state"
+  }
+  required_providers {
+    ko = { source = "ko-build/ko" }
+  }
+}

.github/workflows/ci-build.yaml

@@ -0,0 +1,24 @@
+# Copyright 2024 The Sigstore Authors
+# SPDX-License-Identifier: Apache-2.0
+
+name: ci
+
+on:
+  pull_request:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    if: github.repository == 'sigstore/sigstore-devops-tools'
+
+    steps:
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+
+      - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
+        with:
+          go-version: '1.22'
+          check-latest: true
+
+      - name: build get-oncall
+        run: go build -o get-oncall ./cmd/get_oncall

.github/workflows/deploy.yaml

@@ -0,0 +1,61 @@
+# Copyright 2024 The Sigstore Authors
+# SPDX-License-Identifier: Apache-2.0
+
+name: deploy-terraform
+
+on:
+  push:
+    branches:
+      - "main"
+  workflow_dispatch:
+
+concurrency: deploy
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+
+    if: github.repository == 'sigstore/sigstore-devops-tools'
+
+    permissions:
+      contents: read  # clone the repository contents
+      id-token: write # federates with GCP
+
+    steps:
+    - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+    - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
+      with:
+        go-version: '1.22'
+        check-latest: true
+
+    - uses: google-github-actions/auth@55bd3a7c6e2ae7cf1877fd1ccb9d54c0503c457c # v2.1.2
+      id: auth
+      with:
+        workload_identity_provider: "projects/801815070094/locations/global/workloadIdentityPools/tooling-pool/providers/github-actions-provider"
+        service_account: "[email protected]"
+
+    # Attempt to deploy the terraform configuration
+    - uses: hashicorp/setup-terraform@651471c36a6092792c552e8b1bef71e592b462d8 # v2.0.0
+      with:
+        terraform_version: 1.8
+
+    - working-directory: ./iac
+      run: |
+        terraform init
+
+        terraform plan -out=plan.out
+
+        terraform apply -auto-approve "plan.out"
+
+    - uses: rtCamp/action-slack-notify@4e5fb42d249be6a45a298f3c9543b111b02f7907 # v2.3.0
+      if: ${{ failure() }}
+      env:
+        SLACK_ICON: http://github.com/chainguard-dev.png?size=48
+        SLACK_USERNAME: guardian
+        SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
+        SLACK_CHANNEL: 'sigstore-devops-tools-alerts' # Use a channel
+        SLACK_COLOR: '#8E1600'
+        MSG_MINIMAL: 'true'
+        SLACK_TITLE: Deploying sigstore-devops-tools failed
+        SLACK_MESSAGE: |
+          For detailed logs: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}

.github/workflows/terraform.yaml

@@ -0,0 +1,32 @@
+# Copyright 2024 The Sigstore Authors
+# SPDX-License-Identifier: Apache-2.0
+
+name: terraform-lint-validate
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+jobs:
+  lint-and-validate:
+    name: terraform-lint-validate
+    runs-on: ubuntu-latest
+
+    if: github.repository == 'sigstore/sigstore-devops-tools'
+
+    steps:
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+      - uses: hashicorp/setup-terraform@651471c36a6092792c552e8b1bef71e592b462d8 # v3.1.1
+        with:
+          terraform_version: 1.8
+
+      - run: terraform fmt -check
+
+      - run: cp $GITHUB_WORKSPACE/.github/testdata/backend_override.tf $GITHUB_WORKSPACE/iac
+
+      - working-directory: ./iac
+        run: |
+          terraform init
+          terraform validate

.gitignore

@@ -0,0 +1 @@
+/get-oncall

README.md

@@ -4,7 +4,7 @@ Tools & services to help the development work of Sigstore organization and the i
 
 ## Cloud Functions
 
-* [get-oncall](./get-oncall): Slack slash command to get who are oncall for sigstore public instance. Deployed in GCP Cloud Functions.
+* [get-oncall](./cmd/get-oncall): Slack slash command to get who are oncall for sigstore public instance. Deployed in GCP Cloud Run.
 
 ## Security
 

cmd/get_oncall/main.go

@@ -0,0 +1,33 @@
+// Copyright 2024 The Sigstore Authors
+// SPDX-License-Identifier: Apache-2.0
+
+package main
+
+import (
+	"os"
+
+	"github.com/chainguard-dev/clog"
+	"github.com/spf13/cobra"
+
+	"github.com/sigstore/sigstore-devops-tools/cmd"
+	"github.com/sigstore/sigstore-devops-tools/pkg/get_oncall"
+)
+
+func main() {
+	rootCmd := &cobra.Command{
+		Use:   "get-oncall",
+		Short: "Slack slash command to retrieve the information that who is on-call for sigstore infrastructure.",
+		Run: func(cmd *cobra.Command, args []string) {
+			log := clog.FromContext(cmd.Context())
+			o, err := get_oncall.New(cmd.Context())
+			if err != nil {
+				log.Errorf("failed to create new get_oncall: %v", err)
+				os.Exit(1)
+			}
+
+			o.StartServer()
+		},
+	}
+
+	cmd.ExecuteCommand(rootCmd)
+}

cmd/root.go

@@ -0,0 +1,19 @@
+// Copyright 2024 The Sigstore Authors
+// SPDX-License-Identifier: Apache-2.0
+
+package cmd
+
+import (
+	"os"
+
+	"github.com/chainguard-dev/clog"
+
+	"github.com/spf13/cobra"
+)
+
+func ExecuteCommand(rootCmd *cobra.Command) {
+	if err := rootCmd.Execute(); err != nil {
+		clog.ErrorContext(rootCmd.Context(), err.Error())
+		os.Exit(1)
+	}
+}

go.mod

@@ -0,0 +1,30 @@
+module github.com/sigstore/sigstore-devops-tools
+
+go 1.22.3
+
+require (
+	github.com/PagerDuty/go-pagerduty v1.8.0
+	github.com/chainguard-dev/clog v1.3.1
+	github.com/kelseyhightower/envconfig v1.4.0
+	github.com/slack-go/slack v0.13.0
+	github.com/spf13/cobra v1.8.0
+)
+
+require (
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/google/go-cmp v0.6.0 // indirect
+	github.com/google/go-querystring v1.1.0 // indirect
+	github.com/google/uuid v1.5.0 // indirect
+	github.com/gorilla/websocket v1.5.1 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/stretchr/testify v1.9.0 // indirect
+	golang.org/x/crypto v0.23.0 // indirect
+	golang.org/x/net v0.25.0 // indirect
+	golang.org/x/sys v0.20.0 // indirect
+	golang.org/x/text v0.15.0 // indirect
+	golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 // indirect
+	gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)